Fraudulent behavior identification method and early warning system based on the integration of SMS data and AI

Abstract

The present invention relates to the field of data analysis and monitoring technology, and is a fraud behavior identification method and early warning system based on the fusion of SMS data and AI. The specific method includes: extracting the behavior status data related to the SMS registration behavior of each base station in real time, and calculating and obtaining the suspicious index of each SMS registration behavior; performing preliminary dynamic identification processing on the SMS registration behavior according to the suspicious index, and obtaining the first suspicious SMS registration behavior set and cross-platform behavior tracking data; constructing an AI fusion analysis model, outputting the suspicious index confidence and the fluctuation ratio of the suspicious index confidence, and performing final behavior identification processing on the SMS registration behavior. The present invention solves the problem in the prior art that the fraud behavior identification method usually relies on the historical data analysis of a single platform, which is easy to miss important fraud clues and the fraud behavior identification data has low timeliness.

Description

Technical Field

[0001] The present invention relates to the field of data analysis and monitoring technology, and is a fraud behavior identification method and early warning system based on the fusion of SMS data and AI. Background Art

[0002] SMS registration has become the main means of user identity authentication and registration in various online services. However, the fraud that follows has also shown a trend of diversification and intelligence, bringing huge risks and losses to enterprises and users. Although the existing fraud identification technology can detect and prevent fraud to a certain extent, it still has the following significant shortcomings: the existing fraud identification methods usually rely on data analysis of a single platform, lack of comprehensive tracking and analysis of user cross-platform behavior, resulting in the inability to fully grasp the user's behavioral characteristics and easily miss clues of cross-platform fraud; the existing fraud identification models are mostly static analysis models, which are difficult to cope with dynamically changing fraud methods. Fraudsters can evade detection through constantly changing IP addresses, device IDs and other information, making it difficult for static models to capture these changes; in addition, traditional fraud identification systems are usually based on historical data analysis. For electronic fraud identification, which requires a highly timely data analysis process, they lack real-time performance and cannot capture instantaneous high-risk behaviors in a timely manner, and lack dynamic performance. Summary of the invention

[0003] The purpose of this section is to summarize some aspects of embodiments of the present invention and briefly introduce some preferred embodiments. Some simplifications or omissions may be made in this section and the specification abstract and the invention title of this application to avoid blurring the purpose of this section, the specification abstract and the invention title, and such simplifications or omissions cannot be used to limit the scope of the present invention.

[0004] The technical problem to be solved by the present invention is that in the prior art, the fraud behavior identification method usually relies on the historical data analysis of a single platform, which is easy to miss important fraud clues and the fraud behavior identification data has low timeliness. A fraud behavior identification method and early warning system based on the fusion of SMS data and AI are proposed.

[0005] In order to achieve the above-mentioned purpose, the technical solution of the fraud behavior identification method based on the fusion of SMS data and AI of the present invention comprises the following steps:

[0006] S1: Access the operator's cloud database port to extract the behavior status data related to the SMS registration behavior of each base station in real time;

[0007] S2: importing the behavior status data into the registration behavior suspicious index evaluation strategy, and calculating and obtaining the suspicious index of each SMS registration behavior;

[0008] S3: performing preliminary dynamic identification processing on the SMS registration behavior according to the suspicious index to obtain a first suspicious SMS registration behavior set;

[0009] S4: performing cross-platform activity tracking processing on requesting clients corresponding to all suspicious SMS registration behaviors in the first suspicious SMS registration behavior set to obtain cross-platform behavior tracking data;

[0010] S5: construct an AI fusion analysis model, import the suspicious index and the cross-platform behavior tracking data into the AI ​​fusion analysis model, and output the suspicious index confidence level;

[0011] S6: Import the suspicious index confidence into the credit fluctuation analysis strategy, output the fluctuation ratio of the suspicious index confidence, and perform final identification processing on the SMS registration behavior according to the fluctuation ratio of the suspicious index confidence.

[0012] Specifically, in S2, the registration behavior suspicious index evaluation strategy includes: a base station suspicious evaluation sub-strategy and a user suspicious evaluation sub-strategy;

[0013] The base station suspicious assessment sub-strategy is specifically:

[0014] S21: extracting in real time the total number of SMS registration behaviors and behavior status data of each base station at the current time point, where the total number of base stations is G;

[0015] At the time point Time, the total number of SMS registration behaviors of each base station is J, where j is the subscript, which is the index of the total number of SMS registration behaviors;

[0016] S22: Using the jth SMS registration behavior evaluation center, calculate the registration location distance between the jth SMS registration behavior evaluation center and the requesting base station , synchronously calculate the remaining J-1 SMS registration behaviors and the registration location distance of the requesting base station to form the remaining registration location distance set A, , ; H is the total amount of data in set A, h is the index of set A, is the distance between the hth SMS registration behavior and the registration location of the requesting base station;

[0017] S23: According to S21-S22, the suspicious factor of the base station is calculated and obtained, which is specifically:

[0018] ;

[0019] in, Indicates the suspicious factor of the base station for the jth SMS registration behavior.

[0020] Specifically, the user suspicion assessment sub-strategy specifically includes:

[0021] S24: using the j-th SMS registration behavior evaluation center, calculating the number of repeated IP address octets between the remaining J-1 SMS registration behaviors and the j-th SMS registration behavior;

[0022] S25: preset a standard repetition number of registered IP addresses, screen the SMS registration behaviors that are greater than or equal to the standard repetition number among the repetition number, extract the registration completion timestamps of the SMS registration behaviors obtained by screening, and form a registration completion timestamp set B, , , G is the total amount of data in set B, g is the index of set B, The registration completion timestamp of the g-th SMS registration behavior;

[0023] S26: According to S24-S25, the user suspicious factor is calculated and obtained, which is specifically:

[0024] ;

[0025] in, The user suspicious factor representing the jth SMS registration behavior;

[0026] The registration completion timestamp of the jth SMS registration behavior;

[0027] S27: Based on S21-S26, the suspicious index S of the SMS registration behavior is calculated, specifically: , are the proportional coefficients of base station suspicious factor and user suspicious factor respectively.

[0028] Specifically, in S3, the preliminary dynamic identification processing includes: at the current time point, obtaining the suspicious index of all SMS registration behaviors in the same base station, and arranging the suspicious indexes of all SMS registration behaviors in ascending order, taking the median suspicious index of the sequence as the dynamic identification baseline, marking the SMS registration behaviors whose suspicious index exceeds the dynamic identification baseline as the first suspicious SMS registration behavior set, and at the same time issuing a suspected fraud reminder to the requesting client of all SMS registration behaviors in the first suspicious SMS registration behavior set, wherein the total number of suspicious SMS registration behaviors in the first suspicious SMS registration behavior set is I, and i is the index of the first suspicious SMS registration behavior set; in the first suspicious SMS registration behavior set, the suspicious index set C of the suspicious SMS registration behaviors is .

[0029] Specifically, S4 includes the following specific steps:

[0030] S41: performing cross-platform tracking processing on requesting clients corresponding to all suspicious SMS registration behaviors in the first suspicious SMS registration behavior set, wherein the cross-platform activity tracking processing includes: after the SMS registration behavior is completed, performing cross-platform activity tracking processing on the requesting client of the SMS registration behavior;

[0031] S42: Extract cross-platform behavior tracking data. When five cross-platform activities are found in the requesting client, the AI ​​fusion analysis model is triggered to run and step S5 is executed. Otherwise, cross-platform activity tracking continues.

[0032] Furthermore, the cross-platform behavior tracking data includes: when logging in across platforms, the IP address data of the requesting client, login time, login device ID data, browser fingerprint, screen resolution and mobile phone number.

[0033] Specifically, S5 includes the following specific steps:

[0034] S51: Build AI fusion analysis model;

[0035] S52: Import the suspicious index and the cross-platform behavior tracking data into an AI fusion analysis model, and output the suspicious index confidence level, wherein the output formula of the AI ​​fusion analysis model is:

[0036] ;

[0037] in, is the confidence level of the suspicious index of the i-th suspicious SMS registration behavior;

[0038] The total number of categories of cross-platform behavior tracking data of the requesting client for the i-th suspicious SMS registration behavior, A serial index for cross-platform behavior tracking data;

[0039] x is the subscript, which is the ordinal index of the five cross-platform activities;

[0040] is the weight coefficient of cross-platform activities;

[0041] The amount of cross-platform behavior tracking data representing the xth cross-platform activity;

[0042] It represents the average amount of cross-platform behavior tracking data for 5 cross-platform activities;

[0043] is the average value of the suspicious index in the suspicious index set C.

[0044] Specifically, in S6, the credit volatility analysis strategy is as follows:

[0045] ;

[0046] Among them, the time point when the requesting client of the i-th suspicious SMS registration behavior is tracked for the fifth cross-platform activity and the time point when the i-th suspicious SMS registration behavior is completed are E fraud monitoring unit time periods, where e is the subscript and is the index of the fraud monitoring unit time period;

[0047] bd Fluctuation ratio of the confidence level of the suspicious index;

[0048] During the e-th fraud monitoring unit period, Represents the confidence level of the suspicious index of the i-th suspicious SMS registration behavior; They respectively represent the maximum suspicious index confidence and the minimum suspicious index confidence of I suspicious SMS registration behaviors.

[0049] Specifically, in S6, the final identification processing of the behavior includes: presetting the maximum fluctuation tolerance value of the fluctuation ratio of the suspicious index confidence; when the fluctuation ratio of the suspicious index confidence of the suspicious SMS registration behavior exceeds the maximum fluctuation tolerance value, returning to extract the text in the SMS in the suspicious SMS registration behavior, and performing text preprocessing on the SMS text, including: removing special symbols, punctuation marks, HTML tags and noise information in the text, screening and filtering stop words, accessing the fraudulent SMS large language model, matching the word or phrase sequence repeated in the SMS text in the fraudulent SMS registration behavior in the large language model, and repeatedly confirming whether the SMS registration behavior is fraudulent based on the text matching degree.

[0050] Specifically, in S6, the final identification processing of the behavior also includes: when the fluctuation ratio of the suspicious index confidence of the suspicious SMS registration behavior is less than or equal to the maximum fluctuation tolerance value, the SMS registration behavior is confirmed to be fraudulent, and the request client corresponding to the SMS registration behavior is marked and visualized in the fraud behavior distribution map of the fraud management platform. At the same time, a gradient thermal image is generated according to the suspicious index S of the SMS registration behavior for classification warning processing.

[0051] In addition, the fraud warning system based on the integration of SMS data and AI in the present invention includes the following modules:

[0052] Behavior status data collection module, suspicious index evaluation module, preliminary dynamic identification module, activity tracking module, suspicious index confidence evaluation module, behavior final identification module and fraud alarm module;

[0053] The behavior status data collection module is used to access the operator's cloud database port and extract the behavior status data related to the SMS registration behavior of each base station in real time;

[0054] The suspicious index evaluation module is used to import the behavior status data into the registration behavior suspicious index evaluation strategy, and calculate and obtain the suspicious index of each SMS registration behavior;

[0055] The preliminary dynamic identification module performs preliminary dynamic identification processing on the SMS registration behavior according to the suspicious index to obtain a first suspicious SMS registration behavior set;

[0056] The activity tracking module is used to perform cross-platform activity tracking processing on requesting clients corresponding to all suspicious SMS registration behaviors in the first suspicious SMS registration behavior set to obtain cross-platform behavior tracking data;

[0057] The suspicious index confidence evaluation module is used to construct an AI fusion analysis model, import the suspicious index and the cross-platform behavior tracking data into the AI ​​fusion analysis model, and output the suspicious index confidence;

[0058] The behavior final identification module is used to import the suspicious index confidence into the credit fluctuation analysis strategy, output the fluctuation ratio of the suspicious index confidence, and perform behavior final identification processing on the SMS registration behavior according to the fluctuation ratio of the suspicious index confidence;

[0059] The fraud alarm module performs classified warning processing according to the final identification processing result of the behavior.

[0060] A storage medium stores instructions. When a computer reads the instructions, the computer executes the fraud behavior identification method based on the fusion of SMS data and AI.

[0061] An electronic device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the above-mentioned fraud behavior identification method based on the fusion of SMS data and AI is implemented.

[0062] Compared with the prior art, the technical effects of the present invention are as follows:

[0063] 1. The present invention effectively captures clues of cross-platform fraud by real-time tracking of users' registration and login behaviors on different platforms, thus breaking the problem of data silos and improving the comprehensiveness and accuracy of fraud identification.

[0064] 2. The present invention provides a multi-dimensional analysis perspective by integrating multiple behavioral data (such as IP addresses, device IDs, browser fingerprints, etc.), avoiding the limitations of single-dimensional data and enhancing the ability to identify fraudulent behavior. At the same time, through the suspicious index confidence and credit fluctuation analysis output by the AI ​​fusion analysis model, it provides a more scientific risk assessment result, helping fraud platform managers reduce misjudgments in the decision-making process, and improving the efficiency of fraud risk management and the accuracy of fraud identification.

[0065] 3. The present invention utilizes dynamic identification and processing mechanisms and real-time data extraction. The system can quickly capture abnormal behavior and issue warnings in a timely manner, greatly shortening the time interval from the discovery of suspicious behavior to the warning, and effectively improving the real-time performance of the system.

[0066] 4. Compared with the existing fraud identification methods that directly rely on SMS text content for analysis, the present invention takes into account that device information (such as IP address, device ID, browser fingerprint, etc.) can provide more objective and stable behavioral characteristics, which is more reliable and faster to process than SMS text content; when facing dynamically changing fraud methods, the present invention adopts an auxiliary verification mode of initial dynamic identification processing (device information) followed by final behavior identification processing (SMS text content), which significantly improves the efficiency of fraud behavior identification and forms a multi-level defense system, avoids misjudgment of normal users, and effectively reduces the false alarm rate. BRIEF DESCRIPTION OF THE DRAWINGS

[0067] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative labor. Among them:

[0068] Figure 1 It is a flow chart of the fraud behavior identification method based on the fusion of SMS data and AI of the present invention;

[0069] Figure 2 It is a structural schematic diagram of the fraud warning system based on the fusion of SMS data and AI of the present invention. DETAILED DESCRIPTION

[0070] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the accompanying drawings.

[0071] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0072] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The term "in one embodiment" that appears in different places in this specification does not necessarily refer to the same embodiment, nor does it refer to a separate or selective embodiment that is mutually exclusive with other embodiments.

[0073] Embodiment 1:

[0074] like Figure 1 As shown, the fraud behavior identification method based on the fusion of SMS data and AI in the embodiment of the present invention is as follows: Figure 1 As shown, the specific steps are as follows:

[0075] S1: Access the operator's cloud database port to extract the behavior status data related to the SMS registration behavior of each base station in real time;

[0076] S2: importing the behavior status data into the registration behavior suspicious index evaluation strategy, and calculating and obtaining the suspicious index of each SMS registration behavior;

[0077] In S2, the registration behavior suspicious index evaluation strategy includes: a base station suspicious evaluation sub-strategy and a user suspicious evaluation sub-strategy;

[0078] The base station suspicious assessment sub-strategy is specifically:

[0079] S21: extracting in real time the total number of SMS registration behaviors and behavior status data of each base station at the current time point, where the total number of base stations is G;

[0080] At the time point Time, the total number of SMS registration behaviors of each base station is J, where j is the subscript, which is the index of the total number of SMS registration behaviors;

[0081] S22: Using the jth SMS registration behavior evaluation center, calculate the registration location distance between the jth SMS registration behavior evaluation center and the requesting base station , synchronously calculate the remaining J-1 SMS registration behaviors and the registration location distance of the requesting base station to form the remaining registration location distance set A, , ; H is the total amount of data in set A, h is the index of set A, is the distance between the hth SMS registration behavior and the registration location of the requesting base station;

[0082] S23: According to S21-S22, the suspicious factor of the base station is calculated and obtained, which is specifically:

[0083] ;

[0084] in, Indicates the suspicious factor of the base station for the jth SMS registration behavior.

[0085] The user suspicious assessment sub-strategy specifically includes:

[0086] S24: using the j-th SMS registration behavior evaluation center, calculating the number of repeated IP address octets between the remaining J-1 SMS registration behaviors and the j-th SMS registration behavior;

[0087] S25: preset a standard repetition number of registered IP addresses, screen the SMS registration behaviors that are greater than or equal to the standard repetition number among the repetition number, extract the registration completion timestamps of the SMS registration behaviors obtained by screening, and form a registration completion timestamp set B, , , G is the total amount of data in set B, g is the index of set B, The registration completion timestamp of the g-th SMS registration behavior;

[0088] S26: According to S24-S25, the user suspicious factor is calculated and obtained, which is specifically:

[0089] ;

[0090] in, The user suspicious factor representing the jth SMS registration behavior;

[0091] The registration completion timestamp of the jth SMS registration behavior;

[0092] S27: Based on S21-S26, the suspicious index S of the SMS registration behavior is calculated, specifically: , are the proportional coefficients of base station suspicious factor and user suspicious factor respectively.

[0093] S3: performing preliminary dynamic identification processing on the SMS registration behavior according to the suspicious index to obtain a first suspicious SMS registration behavior set;

[0094] In S3, the preliminary dynamic identification processing includes: at the current time point, obtaining the suspicious index of all SMS registration behaviors in the same base station, and arranging the suspicious indexes of all SMS registration behaviors in ascending order, taking the median suspicious index of the sequence as the dynamic identification baseline, marking the SMS registration behaviors whose suspicious index exceeds the dynamic identification baseline as the first suspicious SMS registration behavior set, and at the same time issuing a suspected fraud reminder to the requesting client of all SMS registration behaviors in the first suspicious SMS registration behavior set, wherein the total number of suspicious SMS registration behaviors in the first suspicious SMS registration behavior set is I, and i is the index of the first suspicious SMS registration behavior set; in the first suspicious SMS registration behavior set, the suspicious index set C of the suspicious SMS registration behaviors is .

[0095] S4: performing cross-platform activity tracking processing on requesting clients corresponding to all suspicious SMS registration behaviors in the first suspicious SMS registration behavior set to obtain cross-platform behavior tracking data;

[0096] S4 includes the following specific steps:

[0097] S41: performing cross-platform tracking processing on requesting clients corresponding to all suspicious SMS registration behaviors in the first suspicious SMS registration behavior set, wherein the cross-platform activity tracking processing includes: after the SMS registration behavior is completed, performing cross-platform activity tracking processing on the requesting client of the SMS registration behavior;

[0098] S42: Extract cross-platform behavior tracking data. When five cross-platform activities are found in the requesting client, the AI ​​fusion analysis model is triggered to run and step S5 is executed. Otherwise, cross-platform activity tracking continues.

[0099] Furthermore, the cross-platform behavior tracking data includes: when logging in across platforms, the IP address data of the requesting client, login time, login device ID data, browser fingerprint, screen resolution and mobile phone number.

[0100] S5: construct an AI fusion analysis model, import the suspicious index and the cross-platform behavior tracking data into the AI ​​fusion analysis model, and output the suspicious index confidence level;

[0101] S5 includes the following specific steps:

[0102] S51: Build AI fusion analysis model;

[0103] S52: Import the suspicious index and the cross-platform behavior tracking data into an AI fusion analysis model, and output the suspicious index confidence level, wherein the output formula of the AI ​​fusion analysis model is:

[0104] ;

[0105] in, is the confidence level of the suspicious index of the i-th suspicious SMS registration behavior;

[0106] The total number of categories of cross-platform behavior tracking data of the requesting client for the i-th suspicious SMS registration behavior, A serial index for cross-platform behavior tracking data;

[0107] x is the subscript, which is the ordinal index of the five cross-platform activities;

[0108] is the weight coefficient of cross-platform activities;

[0109] For example, in this embodiment, , is the weight decay constant, Indicates the time point when the i-th suspicious SMS registration behavior is completed, Indicates the completion time of the xth cross-platform activity;

[0110] The amount of cross-platform behavior tracking data representing the xth cross-platform activity;

[0111] It represents the average amount of cross-platform behavior tracking data for 5 cross-platform activities;

[0112] is the average value of the suspicious index in the suspicious index set C.

[0113] S6: Import the suspicious index confidence into the credit fluctuation analysis strategy, output the fluctuation ratio of the suspicious index confidence, and perform final identification processing on the SMS registration behavior according to the fluctuation ratio of the suspicious index confidence.

[0114] In S6, the credit volatility analysis strategy is as follows:

[0115] ;

[0116] Among them, the time point when the requesting client of the i-th suspicious SMS registration behavior is tracked for the fifth cross-platform activity and the time point when the i-th suspicious SMS registration behavior is completed are E fraud monitoring unit time periods, where e is the subscript and is the index of the fraud monitoring unit time period;

[0117] bd Fluctuation ratio of the confidence level of the suspicious index;

[0118] During the e-th fraud monitoring unit period, Represents the confidence level of the suspicious index of the i-th suspicious SMS registration behavior; They respectively represent the maximum suspicious index confidence and the minimum suspicious index confidence of I suspicious SMS registration behaviors.

[0119] In S6, the final identification processing of the behavior includes: presetting the maximum fluctuation tolerance value of the fluctuation ratio of the suspicious index confidence; when the fluctuation ratio of the suspicious index confidence of the suspicious SMS registration behavior exceeds the maximum fluctuation tolerance value, returning to extract the text in the SMS in the suspicious SMS registration behavior, and performing text preprocessing on the SMS text, including: removing special symbols, punctuation marks, HTML tags and noise information in the text, screening and filtering stop words, accessing the fraudulent SMS large language model, matching the word or phrase sequence repeated in the SMS text in the fraudulent SMS registration behavior in the large language model, and repeatedly confirming whether the SMS registration behavior is fraudulent based on the text matching degree.

[0120] In S6, the final identification processing of the behavior also includes: when the fluctuation ratio of the suspicious index confidence of the suspicious SMS registration behavior is less than or equal to the maximum fluctuation tolerance value, it is confirmed that the SMS registration behavior is fraudulent, and the request client corresponding to the SMS registration behavior is marked and visualized in the fraud behavior distribution map of the fraud management platform. At the same time, a gradient thermal image is generated according to the suspicious index S of the SMS registration behavior for classification warning processing.

[0121] In this embodiment, those skilled in the art can classify the fraud urgency or classify the fraudulent population or identify the fraudulent group based on the gradient thermal image, and perform classification warning processing.

[0122] Embodiment 2:

[0123] like Figure 2 As shown, the fraud warning system based on the fusion of SMS data and AI in the embodiment of the present invention is as follows: Figure 2 As shown, it includes the following modules:

[0124] Behavior status data collection module, suspicious index evaluation module, preliminary dynamic identification module, activity tracking module, suspicious index confidence evaluation module, behavior final identification module and fraud alarm module;

[0125] The behavior status data collection module is used to access the operator's cloud database port and extract the behavior status data related to the SMS registration behavior of each base station in real time;

[0126] The suspicious index evaluation module is used to import the behavior status data into the registration behavior suspicious index evaluation strategy, and calculate and obtain the suspicious index of each SMS registration behavior;

[0127] The preliminary dynamic identification module performs preliminary dynamic identification processing on the SMS registration behavior according to the suspicious index to obtain a first suspicious SMS registration behavior set;

[0128] The activity tracking module is used to perform cross-platform activity tracking processing on requesting clients corresponding to all suspicious SMS registration behaviors in the first suspicious SMS registration behavior set to obtain cross-platform behavior tracking data;

[0129] The suspicious index confidence evaluation module is used to construct an AI fusion analysis model, import the suspicious index and the cross-platform behavior tracking data into the AI ​​fusion analysis model, and output the suspicious index confidence;

[0130] The behavior final identification module is used to import the suspicious index confidence into the credit fluctuation analysis strategy, output the fluctuation ratio of the suspicious index confidence, and perform behavior final identification processing on the SMS registration behavior according to the fluctuation ratio of the suspicious index confidence;

[0131] The fraud alarm module performs classified warning processing according to the final identification processing result of the behavior.

[0132] Embodiment three:

[0133] This embodiment provides an electronic device, including: a processor and a memory, wherein the memory stores a computer program that can be called by the processor;

[0134] The processor executes the above-mentioned fraud behavior identification method based on the fusion of SMS data and AI by calling the computer program stored in the memory.

[0135] The electronic device may have relatively large differences due to different configurations or performances, and may include one or more processors (Central Processing Units, CPU) and one or more memories, wherein the memory stores at least one computer program, which is loaded and executed by the processor to implement the fraud identification method based on the fusion of SMS data and AI provided by the above method embodiment. The electronic device may also include other components for realizing the functions of the device, for example, the electronic device may also have components such as a wired or wireless network interface and an input and output interface to input and output data. This embodiment will not be described in detail here.

[0136] Embodiment 4:

[0137] This embodiment provides a computer-readable storage medium having a rewritable computer program stored thereon;

[0138] When the computer program runs on a computer device, the computer device executes the above-mentioned fraud behavior identification method based on the fusion of SMS data and AI.

[0139] For example, the computer readable storage medium can be a read-only memory (ROM), a random access memory (RAM), a compact disc (CD-ROM), a magnetic tape, a floppy disk, an optical data storage device, etc.

[0140] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0141] It should be understood that determining B based on A does not mean determining B only based on A. B can also be determined based on A and / or other information.

[0142] The above embodiments can be implemented in whole or in part by software, hardware, firmware or any other combination. When implemented by software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When a computer instruction or computer program is loaded or executed on a computer, a process or function according to an embodiment of the present invention is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. Computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, computer instructions can be transmitted from one website site, computer, server or data center to another website site, computer, server or data center through a wired network or / and a wireless network. The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that contains one or more available media sets. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium. The semiconductor medium can be a solid-state hard disk.

[0143] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed in the present invention can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0144] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0145] In the several embodiments provided by the present invention, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of units is only one, and there may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0146] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0147] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0148] In the description of this specification, the description with reference to the terms "one embodiment", "example", "specific example", etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner.

[0149] In summary, compared with the prior art, the technical effects of the present invention are as follows:

[0150] 1. The present invention effectively captures clues of cross-platform fraud by real-time tracking of users' registration and login behaviors on different platforms, thus breaking the problem of data silos and improving the comprehensiveness and accuracy of fraud identification.

[0151] 2. The present invention provides a multi-dimensional analysis perspective by integrating multiple behavioral data (such as IP addresses, device IDs, browser fingerprints, etc.), avoiding the limitations of single-dimensional data and enhancing the ability to identify fraudulent behavior. At the same time, through the suspicious index confidence and credit fluctuation analysis output by the AI ​​fusion analysis model, it provides a more scientific risk assessment result, helping fraud platform managers reduce misjudgments in the decision-making process, and improving the efficiency of fraud risk management and the accuracy of fraud identification.

[0152] 3. The present invention utilizes dynamic identification and processing mechanisms and real-time data extraction. The system can quickly capture abnormal behavior and issue warnings in a timely manner, greatly shortening the time interval from the discovery of suspicious behavior to the warning, and effectively improving the real-time performance of the system.

[0153] 4. Compared with the existing fraud identification methods that directly rely on SMS text content for analysis, the present invention takes into account that device information (such as IP address, device ID, browser fingerprint, etc.) can provide more objective and stable behavioral characteristics, which is more reliable and faster to process than SMS text content; when facing dynamically changing fraud methods, the present invention adopts an auxiliary verification mode of initial dynamic identification processing (device information) followed by final behavior identification processing (SMS text content), which significantly improves the efficiency of fraud behavior identification and forms a multi-level defense system, avoids misjudgment of normal users, and effectively reduces the false alarm rate.

[0154] The above shows and describes the basic principles and main features of the present invention and the advantages of the present invention. It should be understood by those skilled in the art that the present invention is not limited to the above embodiments. The above embodiments and descriptions are only for explaining the principles of the present invention. Without departing from the spirit and scope of the present invention, the present invention may have various changes and improvements, which fall within the scope of the present invention to be protected. The scope of protection of the present invention is defined by the attached claims and their equivalents.

Claims

1. A fraudulent behavior identification method based on the integration of SMS data and AI, characterized in that: The method comprises the following specific steps: S1: Access the operator's cloud database port to extract the behavior status data related to the SMS registration behavior of each base station in real time; S2: importing the behavior status data into the registration behavior suspicious index evaluation strategy, and calculating and obtaining the suspicious index of each SMS registration behavior; The registration behavior suspicious index evaluation strategy includes: a base station suspicious evaluation sub-strategy and a user suspicious evaluation sub-strategy; The base station suspicious assessment sub-strategy is specifically: S21: extracting in real time the total number of SMS registration behaviors and behavior status data of each base station at the current time point, where the total number of base stations is G; At the time point Time, the total number of SMS registration behaviors of each base station is J, where j is the subscript, which is the index of the total number of SMS registration behaviors; S22: Using the jth SMS registration behavior evaluation center, calculate the registration location distance between the jth SMS registration behavior evaluation center and the requesting base station , synchronously calculate the remaining J-1 SMS registration behaviors and the registration location distance of the requesting base station to form the remaining registration location distance set A, , ; H is the total amount of data in set A, h is the index of set A, is the distance between the hth SMS registration behavior and the registration location of the requesting base station; S23: According to S21-S22, the suspicious factor of the base station is calculated and obtained, which is specifically: ； in, The suspicious factor of the base station representing the jth SMS registration behavior; The user suspicious assessment sub-strategy specifically includes: S24: using the j-th SMS registration behavior evaluation center, calculating the number of repeated IP address octets between the remaining J-1 SMS registration behaviors and the j-th SMS registration behavior; S25: preset a standard repetition number of registered IP addresses, screen the SMS registration behaviors that are greater than or equal to the standard repetition number among the repetition number, extract the registration completion timestamps of the SMS registration behaviors obtained by screening, and form a registration completion timestamp set B, , , G is the total amount of data in set B, g is the index of set B, The registration completion timestamp of the g-th SMS registration behavior; S26: According to S24-S25, the user suspicious factor is calculated and obtained, which is specifically: ； in, The user suspicious factor representing the jth SMS registration behavior; The registration completion timestamp of the jth SMS registration behavior; S27: Based on S21-S26, the suspicious index S of the SMS registration behavior is calculated, specifically: , are the proportional coefficients of the base station suspicious factor and the user suspicious factor respectively; S3: performing preliminary dynamic identification processing on the SMS registration behavior according to the suspicious index to obtain a first suspicious SMS registration behavior set; S4: performing cross-platform activity tracking processing on requesting clients corresponding to all suspicious SMS registration behaviors in the first suspicious SMS registration behavior set to obtain cross-platform behavior tracking data; S5: construct an AI fusion analysis model, import the suspicious index and the cross-platform behavior tracking data into the AI ​​fusion analysis model, and output the suspicious index confidence level; S6: Import the suspicious index confidence into the credit fluctuation analysis strategy, output the fluctuation ratio of the suspicious index confidence, and perform final identification processing on the SMS registration behavior according to the fluctuation ratio of the suspicious index confidence.

2. The fraudulent behavior identification method based on the fusion of SMS data and AI according to claim 1 is characterized in that: In S3, the preliminary dynamic identification processing includes: at the current time point, obtaining the suspicious index of all SMS registration behaviors in the same base station, and arranging the suspicious indexes of all SMS registration behaviors in ascending order, taking the median suspicious index of the sequence as the dynamic identification baseline, marking the SMS registration behaviors whose suspicious index exceeds the dynamic identification baseline as the first suspicious SMS registration behavior set, and at the same time issuing a suspected fraud reminder to the requesting client of all SMS registration behaviors in the first suspicious SMS registration behavior set, wherein the total number of suspicious SMS registration behaviors in the first suspicious SMS registration behavior set is I, and i is the index of the first suspicious SMS registration behavior set; in the first suspicious SMS registration behavior set, the suspicious index set C of the suspicious SMS registration behaviors is .

3. The fraudulent behavior identification method based on the fusion of SMS data and AI according to claim 2 is characterized in that: S4 includes the following specific steps: S41: performing cross-platform tracking processing on requesting clients corresponding to all suspicious SMS registration behaviors in the first suspicious SMS registration behavior set, wherein the cross-platform activity tracking processing includes: after the SMS registration behavior is completed, performing cross-platform activity tracking processing on the requesting client of the SMS registration behavior; S42: Extract cross-platform behavior tracking data. When five cross-platform activities are found in the requesting client, the AI ​​fusion analysis model is triggered to run and step S5 is executed. Otherwise, cross-platform activity tracking continues.

4. The fraudulent behavior identification method based on the fusion of SMS data and AI according to claim 3 is characterized in that: S5 includes the following specific steps: S51: Build AI fusion analysis model; S52: Import the suspicious index and the cross-platform behavior tracking data into an AI fusion analysis model, and output the suspicious index confidence level, wherein the output formula of the AI ​​fusion analysis model is: ； in, is the confidence level of the suspicious index of the i-th suspicious SMS registration behavior; The total number of categories of cross-platform behavior tracking data of the requesting client for the i-th suspicious SMS registration behavior, A serial index for cross-platform behavior tracking data; x is the subscript, which is the serial index of the five cross-platform activities; is the weight coefficient of cross-platform activities; The amount of cross-platform behavior tracking data representing the xth cross-platform activity; It represents the average amount of cross-platform behavior tracking data for 5 cross-platform activities; is the average value of the suspicious index in the suspicious index set C.

5. The fraudulent behavior identification method based on the fusion of SMS data and AI according to claim 4 is characterized in that: In S6, the credit volatility analysis strategy is as follows: ； Among them, the time point when the requesting client of the i-th suspicious SMS registration behavior is tracked for the fifth cross-platform activity and the time point when the i-th suspicious SMS registration behavior is completed are E fraud monitoring unit time periods, where e is the subscript and is the index of the fraud monitoring unit time period; bd Fluctuation ratio of the confidence level of the suspicious index; During the e-th fraud monitoring unit period, Represents the confidence level of the suspicious index of the i-th suspicious SMS registration behavior; They respectively represent the maximum suspicious index confidence and the minimum suspicious index confidence of I suspicious SMS registration behaviors.

6. The fraudulent behavior identification method based on the fusion of SMS data and AI according to claim 5 is characterized in that: In S6, the final identification processing of the behavior includes: presetting the maximum fluctuation tolerance value of the fluctuation ratio of the suspicious index confidence; when the fluctuation ratio of the suspicious index confidence of the suspicious SMS registration behavior exceeds the maximum fluctuation tolerance value, returning to extract the text in the SMS in the suspicious SMS registration behavior, and performing text preprocessing on the SMS text, including: removing special symbols, punctuation marks, HTML tags and noise information in the text, screening and filtering stop words, accessing the fraudulent SMS large language model, matching the word or phrase sequence repeated in the SMS text in the fraudulent SMS registration behavior in the large language model, and repeatedly confirming whether the SMS registration behavior is fraudulent based on the text matching degree.

7. The fraudulent behavior identification method based on the fusion of SMS data and AI according to claim 6 is characterized in that: In S6, the final identification processing of the behavior also includes: when the fluctuation ratio of the suspicious index confidence of the suspicious SMS registration behavior is less than or equal to the maximum fluctuation tolerance value, it is confirmed that the SMS registration behavior is fraudulent, and the request client corresponding to the SMS registration behavior is marked and visualized in the fraud behavior distribution map of the fraud management platform. At the same time, a gradient thermal image is generated according to the suspicious index S of the SMS registration behavior for classification warning processing.

8. A fraud warning system based on the fusion of SMS data and AI, used to implement the fraud identification method based on the fusion of SMS data and AI as described in any one of claims 1 to 7, characterized in that: The system includes the following modules: Behavior status data collection module, suspicious index evaluation module, preliminary dynamic identification module, activity tracking module, suspicious index confidence evaluation module, behavior final identification module and fraud alarm module; The behavior status data collection module is used to access the operator's cloud database port and extract the behavior status data related to the SMS registration behavior of each base station in real time; The suspicious index evaluation module is used to import the behavior status data into the registration behavior suspicious index evaluation strategy, and calculate and obtain the suspicious index of each SMS registration behavior; The preliminary dynamic identification module performs preliminary dynamic identification processing on the SMS registration behavior according to the suspicious index to obtain a first suspicious SMS registration behavior set; The activity tracking module is used to perform cross-platform activity tracking processing on requesting clients corresponding to all suspicious SMS registration behaviors in the first suspicious SMS registration behavior set to obtain cross-platform behavior tracking data; The suspicious index confidence evaluation module is used to construct an AI fusion analysis model, import the suspicious index and the cross-platform behavior tracking data into the AI ​​fusion analysis model, and output the suspicious index confidence; The behavior final identification module is used to import the suspicious index confidence into the credit fluctuation analysis strategy, output the fluctuation ratio of the suspicious index confidence, and perform behavior final identification processing on the SMS registration behavior according to the fluctuation ratio of the suspicious index confidence; The fraud alarm module performs classified warning processing according to the final identification processing result of the behavior.

Images